I feel like no matter what, the game client acting as a server must have a hole in the firewall or a coordinating client. > Simply give them a one-off URL that

I feel like no matter what, the game client acting as a server must have a hole in the firewall or a coordinating client. > Simply give them a one-off URL that they type into their gameclient and they connect to it exactly like a public server, which I can then disable after the session. What's the difference between this and a script that SSH's to your firewall and toggles a port's open-ness or alternatively a script that sends the required POST requests to authenticate and toggle your firewall (easily pulled out of the network dev tools in your browser as curl's)? There's a hole in your firewall either way. What difference does it make if that hole that opens to your network is in tail-scales servers (with a public IP and port) or yours? > I feel like this is a glaring product void that inexplicably nobody seems to have noticed? I don't think this is a product void at all. The security cost of port forwarding to port in the non ephemeral range with no listening service is quite low.